Repository navigation
Tags
Tags
fix: add non-root USER to Dockerfile (#84) Closes #68 Run the container as a dedicated system user (diffpoetrylock) instead of root. This reduces the blast radius of any runtime compromise by removing root-level privileges from the container process. Changes: - RUN useradd --system --shell /usr/sbin/nologin diffpoetrylock Creates a passwordless system account with no interactive login shell. - RUN chmod 0755 entrypoint.sh && chown -R diffpoetrylock:diffpoetrylock /src Ensures /src and entrypoint.sh are owned and executable by the new user. - USER diffpoetrylock Switches runtime execution to the non-root account. Validated locally by building the image and confirming: docker run --entrypoint id => uid=999(diffpoetrylock) gid=999(diffpoetrylock) docker run --entrypoint /bin/sh -c 'whoami && ls -l /src/entrypoint.sh' => diffpoetrylock / -rwxr-xr-x 1 diffpoetrylock diffpoetrylock Signed-off-by: Sydney Lyon <sydney.lyon@target.com>